Software that imports security event information from multiple data sources, normalizes the data, and correlates events among the data sources.
Sources:
NIST SP 800-86